Skip to content

Commit 0605e26

Browse files
mpenickMichael Fero
authored andcommitted
CPP-786 Fix TLS v1.3 support (#265)
It turns out TLS v1.3 was not working because of a driver bug. The handshake/connection process should not finish until all remaining handshake data has been written to the socket; otherwise, requests written after the connection process could be processed in an invalid state.
1 parent c3f0e89 commit 0605e26

2 files changed

Lines changed: 4 additions & 8 deletions

File tree

cpp-driver/gtests/src/unit/mockssandra.cpp

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,8 @@ static DH* dh_parameters() {
7878
"VYp84xAy2M6mWWqUm/kokN9QjAiT/DZRxZK8VhY7O9+oATo7/YPCMd9Em417O13k\n"
7979
"+F0o/8IMaQvpmtlAsLc2ZKwGqqG+HD2dOwIBAg==\n"
8080
"-----END DH PARAMETERS-----";
81-
BIO* bio = BIO_new_mem_buf(dh_parameters_pem, -1); // Use null terminator for length
81+
BIO* bio = BIO_new_mem_buf(const_cast<char*>(dh_parameters_pem),
82+
-1); // Use null terminator for length
8283
DH* dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
8384
BIO_free(bio);
8485
return dh;
@@ -420,9 +421,6 @@ bool ServerConnection::use_ssl(const String& key, const String& cert, const Stri
420421
print_ssl_error();
421422
return false;
422423
}
423-
#ifdef SSL_OP_NO_TLSv1_3
424-
SSL_CTX_set_options(ssl_context_, SSL_OP_NO_TLSv1_3);
425-
#endif
426424

427425
SSL_CTX_set_default_passwd_cb_userdata(ssl_context_, (void*)password.c_str());
428426
SSL_CTX_set_default_passwd_cb(ssl_context_, on_password);

cpp-driver/src/socket_connector.cpp

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -182,10 +182,8 @@ void SocketConnector::ssl_handshake() {
182182
size_t size = ssl_session_->outgoing().read(buf, SSL_HANDSHAKE_MAX_BUFFER_SIZE);
183183
if (size > 0) {
184184
socket_->write_and_flush(new BufferSocketRequest(Buffer(buf, size)));
185-
}
186-
187-
// If the handshake process is done then verify the certificate and finish.
188-
if (ssl_session_->is_handshake_done()) {
185+
} else if (ssl_session_->is_handshake_done()) { // If the handshake process is done then verify
186+
// the certificate and finish.
189187
ssl_session_->verify();
190188
if (ssl_session_->has_error()) {
191189
on_error(SOCKET_ERROR_SSL_VERIFY,

0 commit comments

Comments
 (0)